Ankura CTIX FLASH Update - August 11, 2023

Ransomware/Malware Activity

Phishing Platform "EvilProxy" Used in Campaign Targeting 120,000 Microsoft 365 Users

New research has shown that EvilProxy is maintaining its status as a popular platform for targeting multi-factor authentication (MFA) enabled accounts. Proofpoint researchers have seen over 120,000 phishing emails sent to Microsoft 365 accounts associated with 100 different organizations. This threat is using both Adversary-in-the-Middle phishing and other advanced techniques to bypass the increasing use of multifactor authentication. The proliferation of MFA phishing kits has created a market where even people with typically low levels of hacking skills can, for a small price, perform effective and efficient phishing attacks. The initial attack chain commences with the attacker impersonating known and trusted services such as DocuSign or Adobe. After the user clicks on the malicious link, the traffic is redirected using a combination of legitimate